[Eoic]

Registration now ends at Check your email without installing credentials or an authenticated library. Opening a verification link verifies it automatically, then offers fresh sign-in; verification itself creates no session.

Issue and requirements

Closes #60.

Implements TASK-AUTH-03 for FR-1_1, FR-1_2, FR-1_3, and FR-1_4 against the accepted authentication contract and server PR #67. Automatic verification on opening the link is the maintainer-approved revision to the contract's explicit-confirmation step; the endpoint remains POST-only. Server PR #68 separately applies the shared transactional email template.

Summary

• Consume the current pending-registration and verification-required schemas, with resend cooldowns, rate-limit guidance, network retry, and concise action-specific failures. Reject unexpected registration token responses and attempt revocation without storing them.
• Keep the recipient inline with inbox/spam guidance. Group a filled resend action with an outlined back action. Expired, invalid, missing, or used links show a simple unavailable state with Back to sign in. Successful verification has an aligned checkmark and compact action spacing. Secondary verification actions follow the filled button's shape, including e-ink styling.
• Capture the web verification token in memory and scrub the URL before app resources load; apply no-referrer and disable diagnostic URL logging. Bind verification to the configured server. Preserve deployment subpaths, API prefixes, and native callback schemes.
• Consume Google's pending handoff once, bind web callbacks to the initiating server, and require fresh sign-in after verification.
• Clear verification-denied credentials and suspend authenticated sync while preserving the account/server library, queued writes, and cached media. Downloaded books remain readable; offline imports keep their account ownership. Guest/account/server transitions do not merge or clear retained libraries.
• Guard delayed responses and credential writes/deletion against cancellation, disposal, sign-out, and profile changes. Final review fixed the reported race where delayed credential deletion could restore an obsolete verification prompt after sign-out or a new login; four regressions reproduce the failure before the fix.

Testing

All client commands used the pinned SDK and isolated issue worktree, without the main checkout's reader override.

• Worktree-targeted tools/papyrus check client: formatting and analysis clean; 21 Node web tests passed.
• flutter test --no-pub: 2,262 passed, 19 skipped on the final code.
• Chrome callback/base-path/server-binding and browser transport checks: 5 passed.
• Offline web packaging tests: 2 passed.
• Production web build: passed on the final code.
• macOS debug build passed during implementation; native callback interaction was not exercised.
• Locked dependencies resolved without dependency or lockfile changes.

UI evidence

Browser previews of the actual auth widgets were reviewed at 390×844 and 1440×900, covering inbox/cooldown, automatic verification, success, expired links, and final button spacing. Light, dark, and e-ink previews were checked; widget coverage also exercises 320px widths and 2× text scaling. The previews use mocked responses. Independent UI review found no remaining material layout issues.

Compatibility and migration

No dependency, schema, or data migration changes.

1. Make the client and signed-out verification landing available before deploying server enforcement. The client consumes the current server contract.
2. The host in APP_PUBLIC_BASE_URL must serve the app at /verify-email and /auth/callback, including deployment subpaths and SPA fallback. Ship auth_landing.js; align the configured API URL/prefix and Flutter base href.
3. Exclude verification query tokens from proxy/access logs; browser scrubbing cannot remove the initial infrastructure request. Validate real email delivery, callback allowlists, fresh sign-in, and existing sync JWT expiry before rollout.

Notes

Live Google/SMTP/PowerSync smoke tests and native device/screen-reader acceptance were not run. Opt-in sync fixtures now provision verified disposable accounts and delete only those configured test accounts; those tests were not run. CI is separate from local validation. No merge, deployment, generated API snapshot changes, or requirement-verification updates are included. The project task remains In review.

Checklist

• Scoped branch and issue-linked PR target development.
• Regression tests, formatting, analysis, and relevant local checks pass.
• UI evidence, compatibility, and rollout requirements are recorded.
• No credentials, personal data, generated artifacts, or unrelated checkout changes are included.
• Branch contains the current development base.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T23:26:11.464849Z	7c5c35d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c5c35d469

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

❌ Patch coverage is 91.29663% with 49 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
app/lib/pages/auth/verification_page.dart	94.44%	10 Missing ⚠️
app/lib/providers/auth_provider.dart	93.89%	8 Missing ⚠️
app/lib/pages/auth/oauth_callback_page.dart	50.00%	7 Missing ⚠️
app/lib/auth/auth_repository.dart	91.54%	6 Missing ⚠️
app/lib/widgets/auth/auth_continue_button.dart	77.27%	5 Missing ⚠️
app/lib/pages/login_page.dart	73.33%	4 Missing ⚠️
app/lib/config/app_router.dart	72.72%	3 Missing ⚠️
app/lib/platform/web_redirect_stub.dart	25.00%	3 Missing ⚠️
app/lib/widgets/buttons/google_sign_in.dart	75.00%	2 Missing ⚠️
app/lib/pages/register_page.dart	92.85%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Eoic]

.